Efficient sharing of a continuous- variable quantum secret 
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We propose an efficient scfieme for sharing a continuous variabie quantum secret using passive 
optical interferometry and squeezers: this efficiency is achieved by showing that a maximum of two 
squeezers is required to replicate the secret state, and we obtain the cheapest configuration in terms 
of total squeezing cost. Squeezing is a cost for the dealer of the secret as well as for the receivers, 
and we quantify limitations to the fidelity of the replicated secret state in terms of the squeezing 
employed by the dealer. 
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I. INTRODUCTION 

Secret sharing (SS) is an important cryptosystem pro- 
tocol for dealing secret information to a set of players, 
not all of whom can be trusted jj. The encoded secret 
can only be replicated (or, equivalently, reconstructed 0) 
if certain subsets of players collaborate, and these sub- 
sets are referred to as the access structure. The remain- 
ing subsets comprise the adversary structure, and the 
protocol denies the adversary structure any information 
about the secret. The underpinning scheme for arbitrary 
SS is (fc, n)-threshold SS, which involves n players, and 
any subset of k players constitutes a valid set in the ac- 
cess structure; other SS schemes can be constructed via 
threshold SS, for example by distributing unequal num- 
bers of shares to players. Although quantum secret shar- 
ing (QSS) was first introduced as a method to trans- 
mit classical information in a hostile environment with 
quantum-enhanced security 0, QSS was subsequently 
established 0] as a quantum analogue to Shamir's secret 
sharing described above and we use the term QSS to refer 
to the latter approach. QSS provides a valuable protocol 
in quantum communication but also is important as an 
error correction scheme 

Here we are concerned with continuous-variable (CV) 
QSS Q. Quantum information protocols and tasks are 
now studied both as discrete-variable, qubit-based (or 
qudit-based) protocols and tasks 6] and as CV realiza- 
tions 0- CV quantum information protocols are gen- 
erally realized in optical systems and exploit advanced 
quantum optics tools, such as the generation of squeezed 
light "s^ and ability to count single photons 0,^3' well 
as the low rate of decoherence for optical systems. The 
recent demonstration of CV unconditional quantum tele- 
portation 'ill excellent example of the capabilities 

of CV quantum information processes in optical systems. 
Moreover, the technology for this CV quantum telepor- 
tation is not very different from the techniques required 
for CV QSS. 

The original proposal for CV QSS 5] established a gen- 
eral method for CV QSS, and for {k, n)-threshold schemes 



in particular, using interferometry involving passive opti- 
cal elements (mirrors, beam splitters and phase shifters), 
active elements (squeezers) and homodyne detectors. A 
(2, 3)-threshold scheme was proposed involving a single 
squeezer, thereby suggesting an experiment that is within 
the reach of current technology |l2]. The original pro- 
posal of how to perform the general {k,n) scheme was 
complicated, though, by the need for an increasing num- 
ber of squeezers in the interferometer. A practical re- 
alization of threshold-QSS would need to minimize the 
number of optical squeezers as the number of players in- 
creases. 

Here we establish that, for any number of players n 
and any threshold level k for the number of collaborators 
to be in the access structure, the total number of squeez- 
ers needed by the collaborating players does not exceed 
two. This remarkable result informs us that at most two 
squeezers are required for an arbitrary number of players 
n. In particular, to replicate the secret state, the collab- 
orating players require access to an interferometer with 
k channels but only two active components (i.e., squeez- 
ers). This analysis also allows us to determine the total 
amount of squeezing required in a two-squeezer thresh- 
old QSS protocol: the analysis is important because the 
degree of squeezing required for the protocol can be re- 
garded as an effective cost for the procedure . 

The second major concern of this paper is the extent 
to which it is possible to achieve the goals of the CV 
QSS protocol with finite physical resources. For the pro- 
tocol to work perfectly, the dealer needs access to an- 
cillary states prepared with infinite squeezing; as this is 
not physically possible, we analyze the effects of finite 
squeezing, which imposes limitations on the fidelity of 
the replicated secret state. 

The paper is organized as follows: in Section^we sum- 
marize the CV QSS protocol for threshold schemes. In 
Section IIIII we describe efficient replication of the secret 
state, which requires the minimal number of squeezing el- 
ements and minimal overall squeezing. The total amount 
of squeezing is discussed in Section IIVI and we conclude 
m Section El 
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II. THRESHOLD QSS WITH FINITE 
RESOURCES 
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FIG. 1: The optical (fc = 4, n = 7) QSS threshold scheme: the 
dealer encodes the secret via an active interferometer (AI) by 
mixing it with n — 1 ancillary states, transmits the resulting 
n shares to the players, and any k players employ a second 
interferometer to replicate the secret state. The interferome- 
ters are active, meaning that they employ both passive optical 
devices and energy-consuming squeezers. 

The optical {k, n) threshold scheme is sketched in 
Fig. n A dealer holds a pure secret state \4>) realized 
in a single mode of the electromagnetic field and encodes 
the secret as an n-mode entangled state |\1/) by mixing 
with n — 1 ancillary modes in an n-channel active inter- 
ferometer, where the term active refers to one- or two- 
mode squeezers 0|. The dealer then sends one output, 
or "share", to each of the players, and at least k players 
must combine their shares in an active interferometer to 
replicate the secret state. However, the no-cloning the- 
orem ll3 requires that no threshold scheme exists for 
n > 2A; jj]. Also any threshold scheme with n < 2k — 1 
can be obtained from the (fc, 2k — 1) scheme by discard- 
ing 2fc — 1 — n shares. Therefore, we concentrate on the 
(fc, 2k — 1) threshold scheme. 



ate to untangle the information but any smaller number 
is unable to do so. 

The Hilbert space H^") is the space £^(M") of square 
integrable wave functions on R". Thus, if F" denotes the 
linear space of coordinate functions for R", then choosing 
a system of Euclidean coordinates (xi, . . . for any 
vector X g R" is equivalent to picking an orthonormal 
basis (/i, . . . , /„) for F" such that 



/i(x) = Xi 



(1) 



We denote the inner product of these coordinate func- 
tions by /; • fj = 

Suppose the dealer starts with an unentangled tensor 
product 



® \Va) «) Ifl/a) «1 • • • «) \ipi/a) , 



fc-1 



k-1 



(2) 

of the secret state {ip), with fc — 1 copies of a state \ifia) 
and k — 1 copies of a state \ fi/a), where 



Write this state 



x\ipa) = (tTO ) 



where 



(3) 
(4) 

(5) 



i=2 



i=fc+l 



The dealer then entangles the secret state by a linear 
canonical point transformation 



5! 



(6) 



in which the orthogonal (Euclidean) coordinate functions 
{fi} are replaced by a general linear system {gi} for 
which gi{x) = Y.j9i]fj{'^) = J2j9i3Xj- The correspond- 
ing unitary transformation of H^") then maps the state 
I*) to 

\^g)^\detg\'/' I dx"vl/(x)|.gi(x))®..-0|g„(x)). (7) 

For it to be possible for any subset of k players to re- 
construct the secret state, certain conditions must be 
respected. These conditions become apparent when we 
consider the replication algorithm. 



A. Entanglement of the secret state 

The secret is a state \^) e H^^) C'^{R) with wave 
function ip{x) = {x\ijj). Let H^") be the tensor product 
of n = 2fc — 1 copies of H(i), one copy of which is owned 
by each player. The idea is to entangle the information 
among states of H^"^ such that any k players can cooper- 



B. The repHcation algorithm 

In replicating the secret state, it is convenient to iden- 
tify three subspaces of coordinates; i.e., express F" as a 
direct sum of three mutually orthogonal subspaces 

F" = X ® Y ® Z , (8) 
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where X is the one-dimensional space spanned by /i , and 
Y and Z are the (k — l)-diniensional spaces spanned, re- 
spectively, by {/2, . . . , fk} and {fk+i, /«}■ Thus, we 
relabel the {xi} coordinates as {x,yi, Zi) coordinates with 



X — Xi, 



2,. 



The wave function ^' is then 



fe-i 



*(x) = ll^ix) Jl '^a{yi)'~Pl/a{Zi) 



(9) 



(10) 



It will be understood in the following that all n players 
know the encoding transformation in which fi ^ gi- We 
then impose the requirement that this transformation is 
such that the components of any k basis vectors of the 
set {gi} that lie in the subspace X Y C F" are linearly 
independent and hence span this subspace. 

Without loss of generality, we may suppose that the 
first k players form the collaborating set. These players 
are able to make any transformation of the states in the 
subset of Hilbert spaces accessible to them. However, we 
will restrict the transformations they can make to those 
corresponding to general linear coordinate transforma- 
tions, as defined above. Let us suppose they make the 
transformation 



— ^ij f j 



(11) 



with the understanding that = gi for all i > k. 

The orthogonal decomposition of F" given by Eq. ^ 
now defines a corresponding decomposition of every 
vector as a sum of three mutually orthogonal vectors 



Equivalently, we can write 



(12) 



(13) 



We now claim that a transformation gi ^i which is 
such that 

ai = 1, Pi= 0, 
cti+i = ak+i: Pi+1 = Pk+i, i = 1, . . . , fc - 1 , (14) 

replicates the secret for sufficiently large values of the 
parameter a. We demonstrate this result explicitly for 
the simple case in which k = 2 and n — 5. 

For the k = 2, n = 3 case (^1,^2, ■fa) will have expan- 
sions of the form 



^i(x) = X + 71Z, 
^2(x) = ax + f3y + j2Z, 
6(x) = ax + (3y + -f3Z, 



(15) 
(16) 
(17) 



and l^*^) will be given by 

1/3(72-73)1^/^ 



1*^ 



ri/2 



V'(x) exp [ - _ !!_^2 



X |a; -f 7iz) ® \ax + Py + 72^) <^ \ax + jSy + ^^z) 
X dxdydz. (18) 

By a change of the variable a; to x — 71 z, we then have 
1/5(72 - 73)1^/' 



ri/2 



V'(a; - 7iz) 



r ? ^ ?1 

xexp[-^y -yz] 

X \x) ® \ax -f /3y -f 72-2) \ax + (3y + j'^z) 
xdxdydz. (19) 

Now observe that if a is sufficiently large that ■ip{x — 
jiz) « ^{x) for all values of z for which exp[— is 
non-negligible, then 

a2 ^2 
^p{x - 7iz) exp [ - —z^] « iPix) exp [ - —z^] . (20) 

Moreover, this approximation becomes precise to any de- 
sired level of accuracy for sufficiently large values of a. 
By a second change of variables. 



X —>■ X, Py ^ l3y — ax , 



(21) 



we also have 



I..) - /.(.) 

X «-p[-^(2/-^-)'-y-'] 

X |x) (g) |/3y 72^) «) |/3y -f 732;) da; dy dz . (22) 

Now for a sufficiently large that exp [ — ^{y — ^a^)'] ~ 

exp [ — 23t2/'] ^oy all values of x for which tp{x) is non- 
negligible, we have 



1*^ 



1/3(72 - 73)1^/' 



ri/2 



V'(x) exp [ - _ _^2 



X \x) iSi \Py + j'2z) iSi \Py + "f':}z) dx dy dz 

= m®m, (23) 



where |$) is the entangled state 

X \Py + j'^z) <g) \Py + j!iz) dy dz 



(24) 



The generalization of the proof to larger values of k is 
straightforward. 
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C. Fidelity of the secret sharing scheme 

As we have seen, the CV QSS scheme works perfectly 
only for a — > oo in Eq. ^ . In this case the dealer has in- 
finitely squeezed ancillary states with which to entangle 
the secret state \tfj). The situation is similar to CV quan- 
tum teleportation f^, where an ideal EPR pair (which 
is a two-mode infinitely squeezed vacuum) is required for 
the protocol to work perfectly. However, with some loss 
of fidelity the scheme can be adapted to a realistic, finite- 
squeezing situation 0|. In CV QSS, finite squeezing 
implies that the secret state can only be approximately 
replicated because there is entanglement between the se- 
cret state and the shares in both the access structure 
and the adversary structure, which limits the fidelity of 
the replicated state with respect to the original secret 
state. Also entanglement with the adversarial shares al- 
lows some information about the secret state to escape. 
These compromises to CV QSS are reduced by increasing 
the degree of squeezing. 

A detailed analysis reveals that the reduced density op- 
erator p' of the replicated secret is related to the original 
density operator p — by 



p\x,x') ^ {x\pV) = 



exp 



u'^{x — x'Y 



X p{x- y, x' - y) exp 



Ay. (25) 



Here v is the norm of the vector 71 in Eq. (|12l) and iP' — 



4a^ 



X^iL/ I where {u^} are the coefficients of the expansion 
aj — X^iLi^ Ui(3ji, j — 2, . . . , fc. The parameters u and 
V quantify the degree to which the secret state has been 
degraded for a given a by encoding and decoding. Perfect 
replication corresponds to u = and 1; = 0, which is 
in general unachievable. The degradation is symmetric 
under the exchange of u < — > v. 

Eq. (|25|l shows that the effect of using finite squeez- 
ing for the encoding procedure is twofold. First, the 
Gaussian factor in front of the integral in Eq. H25() su- 
presses off-diagonal elements of the density operator for 
x — x' ^ 2a/ u implying decoherence. Second, the density 
operator element of the replicated secret is a convolution 
of the original density operator with a Gaussian. The 
larger a is, the more accurately is the secret state repli- 
cated; in the limit a — > 00, it is perfectly replicated. 

The replication fidelity of the system can be character- 
ized by evaluating J-' — {^Ip'lijj) for some standard secret 
state \tp). For an arbitrary coherent state as the secret, 
the fidelity is given by the function 

-1/2 



jr ^ [1 + (u^ + t;^)/2a^ + u^v^id 



(26) 



The dependence of on r = In a for some particular 
values of u and v can be seen in Fig. [3 The fidelity tends 
to unity for large squeezing (a oo,r —^ 00) and to zero 
for large antisqueezing (a — > 0, r — s- —00). The fidelity for 
r = corresponds to the case when the ancillary states 
are all vacuum states. 



<D 
T3 




FIG. 2: The fidelity JT versus the squeezing parameter r = In a 
for an arbitrary coherent state as the secret. Two cases are 
presented: (1) u = 0.5 and w = 1 (solid line) and (2) u = 3 
and V — 5 (dashed line). 



III. EFFICIENT REPLICATION 

In the previous section we have established a replica- 
tion protocol for the access structure; here we seek the 
most efficient protocol, which minimizes the total number 
of squeezers (expensive components in an active interfer- 
ometer) required. In the following wc show that by a 
suitable choice of a particular disentangling transforma- 
tion, it is possible to reduce the total number of squeezers 
required to no more than two. 

Let £,i (i denote the orthogonal projection of G F" 
to the subspace X Y C F" so that 



j 

Ci(x) = a.iX + ^Pijyj 
j 



(27) 



Claim: A transformation gi S,i = ai + (3i + "fi, with 
ai e X, /3j e Y, and ji S Z, which leaves the coordinates 
— 9i unchanged for i = fc + 1 , . . . , 71 and is such that 

ai = 1 , /3i = , 
span(C2, . . . , Cfe) = span(C/c+i, ■ ■ ■ Xn) , (28) 

disentangles the secret state for sufficiently large values 
of the parameter a. 

To prove this claim, we show, by a change of variables 
that, for sufficiently large values of a, the state 

k 

1*5) = IdetCr/^l dx^{x)f[j-^ J dy.dz. 



1 



2a^y' 2^' 



X exp 

X |a; + 7i(x))(8|C2(x)+72(x)) 
«)---(g)|C„(x)-H7n(x)) 



(29) 
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defined by the transformation gi 
the form 



^i, is expressible in 



(30) 



with 



l<i>) = |detCr/^n^/dy.d 



I 2a^ 



X |/32(x) + 7^(x)) ® • • • ® |/3„(x) + 7;(x)) 



(31) 



This result is achieved by first changing the variable x 
to X — ^ijZj and noting that, if a is sufficiently large, 



then ^(x - J^-i 7ij^ 



ipix) for all values of ^ lijZj 



for which exp [ — ^ z^^ is non-negligible. This shows 
that 

k 

I*?) = Idetfli/^l da:V'(x)n-i^ 1 dy, dz, 



X exp 



J_ 

X |a::)®|C2(x)+72W) 
(^•••(^|C„(x)+7;(x)) 



(32) 



Next observe that, since the vectors {(k+i, ■ ■ ■ ,Cn} 
are linear combinations of the vectors {^2, ■ • ■ ,Cfc}, the 
change of variables given by the projection Q — ai+(3i — > 
f3i, for i — 2, . . . , /c, results in the corresponding projec- 
tions Ci — > Pi for i = k + 1, . . . ,n. Now, if /3'^ is defined 
such that 



(33) 



then the projection Q Pi, for i — 2, . . . ,k, corresponds 
to the coordinate transformation yi ^ yi — /?'-'aj) x. 
Thus, if a is sufficiently large that exp [ — '^{Vi ~ 
/^^"'ckj) a;)^] ~ exp [ — ^yf\ for all values of x for 
which ili{x) is non-negligible, we obtain Eq. 

Now, let the vectors gi defining the encoded state \^g) 
(0 by the linear transformation jnj have decomposition, 
parallel to that given by Eq. (|27|l . 



gi = Ki + Xi , 
gi = Ci = Ci+ii, 



i — 1, . . . , fc , 

i = k + I, . . . ,n , 



(34) 



with e X © Y and Aj G Z, respectively. And let T 
denote a transformation 



5» ^ 6 



^T^^gj 



such that the vectors 

A: 
J = l 



(35) 



(36) 



satisfy the disentanglement criteria (|28|) . 

The condition that the vectors C2, . . . , Cfc span the same 
subspace of X ® Y as do Cfc+i, ■ ■ • , C™ can be satisfied 
by requiring that both sets are orthogonal to a common 
vector u G X e Y. Thus, if G X ® Y is a vector defined 
such that 

V ■(,, = {) i> k, (37) 
the transformation T is required to satisfy the equation 

k 

V ■ Q = Tij V ■ Kj — , y i ~ 2, . . . k . (38) 

To satisfy the first condition of Eq. H28(l . T should also 
be such that 



(39) 



so that Ci(x) = X. 

Eq. H39|) implies that the first row of the matrix T 
is the row vector a = (ai, a2, . . . , a^) whose components 

are the coefficients in the expansion fi = X]j=i ^j'^j^ i-^-j 
Tij = Qj. The remaining rows can be defined as a set of 
orthogonal row vectors {Ti; i = 2, . . . , fc}, all of which are 
orthogonal to the unit row vector Wi whose components 
are given by 



(40) 



The orthogonality of the vectors {Ti\i > 1} to Wi then 
ensures that X]j=i^y^ii = for i > 1 and that the 
condition (|38() is satisfied. The norms of the orthogonal 
vectors {Ti\i > 1} are arbitrary and can be chosen to 
minimize the cost of the transformation. We find (cf. 
following section) that it is convenient to choose all but 
one of these vectors (e.g., the vector T2) to be normalized 
to unity. Denoting the norm of the vector T2 by 7, we 
then have 



Ti 



2j 



(41) 



> 2. 



where Wij is an orthogonal matrix. 

As remarked above, an orthogonal transformation of 
the collaborating players' states can be achieved with 
passive elements. However, the replacement of the first 
row of W by the vector a, in forming the matrix T , means 
that the resulting transformation involves squeezing op- 
erations and hence a need for active elements. As we now 
show, the transformation defined by T can be achieved 
with just two squeezers. 

Choose the vector W2 to lie in the span of the vectors 
a and Wi. It then follows that a is expandable as a = 



6 



aWi + PW2 and 



7 



T = 







V 







w = vw, 



(42) 



with a free parameter 7 7^ 0. This parameter can be 
adjusted, according to the criteria outhned in Sec. llVl to 
minimize the demands on the squeezing resources. The 
GL(fc,K) matrix V can now be factored as V = XVdY, 
with X and Y orthogonal matrices and 



Vd = diag(ui,i;2, 1, 1, . . . , 1) 



(43) 



The complete transformation T then assumes the simple 
form 



T = VW = XVdYW = XVdZ, 



(44) 



with both X and Z orthogonal matrices. 

The disentangling transformation represented by the 
matrix T is now achieved by a sequence of three trans- 
formations: the first transformation, represented by the 
orthogonal matrix Z, is achieved by a passive interferom- 
eter consisting of only beam splitters and phase shifters; 
the transformation represented by the diagonal matrix 
Vd is given by single-mode Sp(l, M) squeezers on the first 
two modes, with squeezing parameters ri = Inwi and 
r2 = lnu2; finally, the transformation corresponding to 
the matrix X is given by a two-mode beam splitter (see 
Fig. 13). Hence the number of active optical elements 
(squeezers) is reduced to two. 



squeezer 
squeezer^ 





passive 
interferometer 















passive 
interferometer 



FIG. 3: The general scheme of an interferometer used by the 
players to decode the secret state. The passive fc-port interfer- 
ometer is followed by two independent single-mode squeezers, 
and the last step is a passive two-mode interferometer that 
yields the secret at one output port. 



IV. TOTAL AMOUNT OF SQUEEZING 

It is of interest not only to consider the number of ac- 
tive optical elements necessary for the replication part 
of QSS, but also the total amount of squeezing R. It 
is natural to define this quantity as the sum of magni- 
tudes of squeezing parameters corresponding to the two 
squeezers, i.e.. 



which can be minimized by a judicious choice of 7 in 
Eq. 1121). 

We can express R as R ~ ^(| InAij + | lnA2|), where 
A1.2 are the eigenvalues of the symmetric matrix V'V 

with V = f " ' 

simple calculation shows that the eigenvalues are 



and V' the transpose oi V . A 



+ l3^+j^± V(a2+/32 + 72)2 - 4a2/32 



R 



r2 



|lnvi| -I- |lnt;2|. 



(45) 



^1,2 — 2 

(46) 

Depending on 7, the total amount of squeezing R is 
either (i) R = i|ln(AiA2)| (if both InAi and lnA2 have 
the same sign) or (ii) R = i|ln(Ai/A2)| (if InAi and 
In A2 have different signs) . We seek 7 that minimizes R, 
which can occur for either case (i) or (ii), so both must be 
checked. We define the quantity k = {l—a'^—P^)/{l—a'^) 
and have: 

(i) The minimum value of Rij) is i?rnin = | ln(KQ;)| and 
occurs for 70 = ^/K in the following situations: 

+ 0^ <l and + 0^ < n 
a2 + /32 > 1 + /32/a2 and ^ (3^ > k 

(ii) The minimum value of i?(7) is -Rmin — 
ln[(-\/a2 -I- /32 + |/3|)/|a|] and occurs for 70 = 
\/ + fP in the following situations: 

1 <a2+^2 < 1 + /32/q^2 
1 + ^2/^,2 < Q,2 _^ ^2 < ^ 

The strategy for a collaborating group of players to 
minimize the squeezing resources for the replication of 
the secret state is the following: for given a and /3, the 
players calculate the value of n and decide which of the 
two cases (i) or (ii) occurs. Then they find the value 70 
and construct the matrix T in Eq. (|42|l and from this, the 
corresponding active interferometer that contains only 
two squeezers with a minimum total amount of squeezing 

equal to i?min- 

V. CONCLUSION 

We have shown that the replication procedure in op- 
tical continuous-variable quantum secret sharing can be 
achieved with a small number (at most two) of squeezing 
elements for any authorized group of players. In par- 
ticular, we have demonstrated this for the QSS thresh- 
old schemes. We have quantified the total amount of 
squeezing defined as the sum of absolute values of the 
single-mode squeezing parameters, and found its mini- 
mum value analytically. We have also seen that in the re- 
alistic situation when the dealer has only finite squeezing 
resources available, the density operator of the replicated 
secret becomes a Gaussian convolution of the original se- 
cret state. 
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